1 // SPDX-License-Identifier: GPL-2.0
5 * Copyright (C) 1995 Linus Torvalds
8 #include <linux/stddef.h>
9 #include <linux/kernel.h>
10 #include <linux/export.h>
11 #include <linux/time.h>
13 #include <linux/errno.h>
14 #include <linux/stat.h>
15 #include <linux/file.h>
17 #include <linux/fsnotify.h>
18 #include <linux/dirent.h>
19 #include <linux/security.h>
20 #include <linux/syscalls.h>
21 #include <linux/unistd.h>
22 #include <linux/compat.h>
23 #include <linux/uaccess.h>
25 #include <asm/unaligned.h>
28 * Note the "unsafe_put_user() semantics: we goto a
31 * Also note how we use a "while()" loop here, even though
32 * only the biggest size needs to loop. The compiler (well,
33 * at least gcc) is smart enough to turn the smaller sizes
34 * into just if-statements, and this way we don't need to
35 * care whether 'u64' or 'u32' is the biggest size.
37 #define unsafe_copy_loop(dst, src, len, type, label) \
38 while (len >= sizeof(type)) { \
39 unsafe_put_user(get_unaligned((type *)src), \
40 (type __user *)dst, label); \
41 dst += sizeof(type); \
42 src += sizeof(type); \
43 len -= sizeof(type); \
47 * We avoid doing 64-bit copies on 32-bit architectures. They
48 * might be better, but the component names are mostly small,
49 * and the 64-bit cases can end up being much more complex and
50 * put much more register pressure on the code, so it's likely
51 * not worth the pain of unaligned accesses etc.
53 * So limit the copies to "unsigned long" size. I did verify
54 * that at least the x86-32 case is ok without this limiting,
55 * but I worry about random other legacy 32-bit cases that
56 * might not do as well.
58 #define unsafe_copy_type(dst, src, len, type, label) do { \
59 if (sizeof(type) <= sizeof(unsigned long)) \
60 unsafe_copy_loop(dst, src, len, type, label); \
64 * Copy the dirent name to user space, and NUL-terminate
65 * it. This should not be a function call, since we're doing
66 * the copy inside a "user_access_begin/end()" section.
68 #define unsafe_copy_dirent_name(_dst, _src, _len, label) do { \
69 char __user *dst = (_dst); \
70 const char *src = (_src); \
71 size_t len = (_len); \
72 unsafe_copy_type(dst, src, len, u64, label); \
73 unsafe_copy_type(dst, src, len, u32, label); \
74 unsafe_copy_type(dst, src, len, u16, label); \
75 unsafe_copy_type(dst, src, len, u8, label); \
76 unsafe_put_user(0, dst, label); \
80 int iterate_dir(struct file *file, struct dir_context *ctx)
82 struct inode *inode = file_inode(file);
85 if (file->f_op->iterate_shared)
87 else if (!file->f_op->iterate)
90 res = security_file_permission(file, MAY_READ);
95 res = down_read_killable(&inode->i_rwsem);
97 res = down_write_killable(&inode->i_rwsem);
102 if (!IS_DEADDIR(inode)) {
103 ctx->pos = file->f_pos;
105 res = file->f_op->iterate_shared(file, ctx);
107 res = file->f_op->iterate(file, ctx);
108 file->f_pos = ctx->pos;
109 fsnotify_access(file);
113 inode_unlock_shared(inode);
119 EXPORT_SYMBOL(iterate_dir);
122 * POSIX says that a dirent name cannot contain NULL or a '/'.
124 * It's not 100% clear what we should really do in this case.
125 * The filesystem is clearly corrupted, but returning a hard
126 * error means that you now don't see any of the other names
127 * either, so that isn't a perfect alternative.
129 * And if you return an error, what error do you use? Several
130 * filesystems seem to have decided on EUCLEAN being the error
131 * code for EFSCORRUPTED, and that may be the error to use. Or
132 * just EIO, which is perhaps more obvious to users.
134 * In order to see the other file names in the directory, the
135 * caller might want to make this a "soft" error: skip the
136 * entry, and return the error at the end instead.
138 * Note that this should likely do a "memchr(name, 0, len)"
139 * check too, since that would be filesystem corruption as
140 * well. However, that case can't actually confuse user space,
141 * which has to do a strlen() on the name anyway to find the
142 * filename length, and the above "soft error" worry means
143 * that it's probably better left alone until we have that
146 static int verify_dirent_name(const char *name, int len)
148 if (WARN_ON_ONCE(!len))
150 if (WARN_ON_ONCE(memchr(name, '/', len)))
156 * Traditional linux readdir() handling..
158 * "count=1" is a special case, meaning that the buffer is one
159 * dirent-structure in size and that the code can't handle more
160 * anyway. Thus the special "fillonedir()" function for that
161 * case (the low-level handlers don't need to care about this).
164 #ifdef __ARCH_WANT_OLD_READDIR
166 struct old_linux_dirent {
168 unsigned long d_offset;
169 unsigned short d_namlen;
173 struct readdir_callback {
174 struct dir_context ctx;
175 struct old_linux_dirent __user * dirent;
179 static int fillonedir(struct dir_context *ctx, const char *name, int namlen,
180 loff_t offset, u64 ino, unsigned int d_type)
182 struct readdir_callback *buf =
183 container_of(ctx, struct readdir_callback, ctx);
184 struct old_linux_dirent __user * dirent;
190 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
191 buf->result = -EOVERFLOW;
195 dirent = buf->dirent;
196 if (!access_ok(dirent,
197 (unsigned long)(dirent->d_name + namlen + 1) -
198 (unsigned long)dirent))
200 if ( __put_user(d_ino, &dirent->d_ino) ||
201 __put_user(offset, &dirent->d_offset) ||
202 __put_user(namlen, &dirent->d_namlen) ||
203 __copy_to_user(dirent->d_name, name, namlen) ||
204 __put_user(0, dirent->d_name + namlen))
208 buf->result = -EFAULT;
212 SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
213 struct old_linux_dirent __user *, dirent, unsigned int, count)
216 struct fd f = fdget_pos(fd);
217 struct readdir_callback buf = {
218 .ctx.actor = fillonedir,
225 error = iterate_dir(f.file, &buf.ctx);
233 #endif /* __ARCH_WANT_OLD_READDIR */
236 * New, all-improved, singing, dancing, iBCS2-compliant getdents()
239 struct linux_dirent {
242 unsigned short d_reclen;
246 struct getdents_callback {
247 struct dir_context ctx;
248 struct linux_dirent __user * current_dir;
249 struct linux_dirent __user * previous;
254 static int filldir(struct dir_context *ctx, const char *name, int namlen,
255 loff_t offset, u64 ino, unsigned int d_type)
257 struct linux_dirent __user * dirent;
258 struct getdents_callback *buf =
259 container_of(ctx, struct getdents_callback, ctx);
261 int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2,
264 buf->error = verify_dirent_name(name, namlen);
265 if (unlikely(buf->error))
267 buf->error = -EINVAL; /* only used if we fail.. */
268 if (reclen > buf->count)
271 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
272 buf->error = -EOVERFLOW;
275 dirent = buf->previous;
276 if (dirent && signal_pending(current))
280 * Note! This range-checks 'previous' (which may be NULL).
281 * The real range was checked in getdents
283 if (!user_access_begin(dirent, sizeof(*dirent)))
286 unsafe_put_user(offset, &dirent->d_off, efault_end);
287 dirent = buf->current_dir;
288 unsafe_put_user(d_ino, &dirent->d_ino, efault_end);
289 unsafe_put_user(reclen, &dirent->d_reclen, efault_end);
290 unsafe_put_user(d_type, (char __user *) dirent + reclen - 1, efault_end);
291 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
294 buf->previous = dirent;
295 dirent = (void __user *)dirent + reclen;
296 buf->current_dir = dirent;
297 buf->count -= reclen;
302 buf->error = -EFAULT;
306 SYSCALL_DEFINE3(getdents, unsigned int, fd,
307 struct linux_dirent __user *, dirent, unsigned int, count)
310 struct linux_dirent __user * lastdirent;
311 struct getdents_callback buf = {
312 .ctx.actor = filldir,
314 .current_dir = dirent
318 if (!access_ok(dirent, count))
325 error = iterate_dir(f.file, &buf.ctx);
328 lastdirent = buf.previous;
330 if (put_user(buf.ctx.pos, &lastdirent->d_off))
333 error = count - buf.count;
339 struct getdents_callback64 {
340 struct dir_context ctx;
341 struct linux_dirent64 __user * current_dir;
342 struct linux_dirent64 __user * previous;
347 static int filldir64(struct dir_context *ctx, const char *name, int namlen,
348 loff_t offset, u64 ino, unsigned int d_type)
350 struct linux_dirent64 __user *dirent;
351 struct getdents_callback64 *buf =
352 container_of(ctx, struct getdents_callback64, ctx);
353 int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1,
356 buf->error = verify_dirent_name(name, namlen);
357 if (unlikely(buf->error))
359 buf->error = -EINVAL; /* only used if we fail.. */
360 if (reclen > buf->count)
362 dirent = buf->previous;
363 if (dirent && signal_pending(current))
367 * Note! This range-checks 'previous' (which may be NULL).
368 * The real range was checked in getdents
370 if (!user_access_begin(dirent, sizeof(*dirent)))
373 unsafe_put_user(offset, &dirent->d_off, efault_end);
374 dirent = buf->current_dir;
375 unsafe_put_user(ino, &dirent->d_ino, efault_end);
376 unsafe_put_user(reclen, &dirent->d_reclen, efault_end);
377 unsafe_put_user(d_type, &dirent->d_type, efault_end);
378 unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
381 buf->previous = dirent;
382 dirent = (void __user *)dirent + reclen;
383 buf->current_dir = dirent;
384 buf->count -= reclen;
389 buf->error = -EFAULT;
393 int ksys_getdents64(unsigned int fd, struct linux_dirent64 __user *dirent,
397 struct linux_dirent64 __user * lastdirent;
398 struct getdents_callback64 buf = {
399 .ctx.actor = filldir64,
401 .current_dir = dirent
405 if (!access_ok(dirent, count))
412 error = iterate_dir(f.file, &buf.ctx);
415 lastdirent = buf.previous;
417 typeof(lastdirent->d_off) d_off = buf.ctx.pos;
418 if (__put_user(d_off, &lastdirent->d_off))
421 error = count - buf.count;
428 SYSCALL_DEFINE3(getdents64, unsigned int, fd,
429 struct linux_dirent64 __user *, dirent, unsigned int, count)
431 return ksys_getdents64(fd, dirent, count);
435 struct compat_old_linux_dirent {
436 compat_ulong_t d_ino;
437 compat_ulong_t d_offset;
438 unsigned short d_namlen;
442 struct compat_readdir_callback {
443 struct dir_context ctx;
444 struct compat_old_linux_dirent __user *dirent;
448 static int compat_fillonedir(struct dir_context *ctx, const char *name,
449 int namlen, loff_t offset, u64 ino,
452 struct compat_readdir_callback *buf =
453 container_of(ctx, struct compat_readdir_callback, ctx);
454 struct compat_old_linux_dirent __user *dirent;
455 compat_ulong_t d_ino;
460 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
461 buf->result = -EOVERFLOW;
465 dirent = buf->dirent;
466 if (!access_ok(dirent,
467 (unsigned long)(dirent->d_name + namlen + 1) -
468 (unsigned long)dirent))
470 if ( __put_user(d_ino, &dirent->d_ino) ||
471 __put_user(offset, &dirent->d_offset) ||
472 __put_user(namlen, &dirent->d_namlen) ||
473 __copy_to_user(dirent->d_name, name, namlen) ||
474 __put_user(0, dirent->d_name + namlen))
478 buf->result = -EFAULT;
482 COMPAT_SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
483 struct compat_old_linux_dirent __user *, dirent, unsigned int, count)
486 struct fd f = fdget_pos(fd);
487 struct compat_readdir_callback buf = {
488 .ctx.actor = compat_fillonedir,
495 error = iterate_dir(f.file, &buf.ctx);
503 struct compat_linux_dirent {
504 compat_ulong_t d_ino;
505 compat_ulong_t d_off;
506 unsigned short d_reclen;
510 struct compat_getdents_callback {
511 struct dir_context ctx;
512 struct compat_linux_dirent __user *current_dir;
513 struct compat_linux_dirent __user *previous;
518 static int compat_filldir(struct dir_context *ctx, const char *name, int namlen,
519 loff_t offset, u64 ino, unsigned int d_type)
521 struct compat_linux_dirent __user * dirent;
522 struct compat_getdents_callback *buf =
523 container_of(ctx, struct compat_getdents_callback, ctx);
524 compat_ulong_t d_ino;
525 int reclen = ALIGN(offsetof(struct compat_linux_dirent, d_name) +
526 namlen + 2, sizeof(compat_long_t));
528 buf->error = -EINVAL; /* only used if we fail.. */
529 if (reclen > buf->count)
532 if (sizeof(d_ino) < sizeof(ino) && d_ino != ino) {
533 buf->error = -EOVERFLOW;
536 dirent = buf->previous;
538 if (signal_pending(current))
540 if (__put_user(offset, &dirent->d_off))
543 dirent = buf->current_dir;
544 if (__put_user(d_ino, &dirent->d_ino))
546 if (__put_user(reclen, &dirent->d_reclen))
548 if (copy_to_user(dirent->d_name, name, namlen))
550 if (__put_user(0, dirent->d_name + namlen))
552 if (__put_user(d_type, (char __user *) dirent + reclen - 1))
554 buf->previous = dirent;
555 dirent = (void __user *)dirent + reclen;
556 buf->current_dir = dirent;
557 buf->count -= reclen;
560 buf->error = -EFAULT;
564 COMPAT_SYSCALL_DEFINE3(getdents, unsigned int, fd,
565 struct compat_linux_dirent __user *, dirent, unsigned int, count)
568 struct compat_linux_dirent __user * lastdirent;
569 struct compat_getdents_callback buf = {
570 .ctx.actor = compat_filldir,
571 .current_dir = dirent,
576 if (!access_ok(dirent, count))
583 error = iterate_dir(f.file, &buf.ctx);
586 lastdirent = buf.previous;
588 if (put_user(buf.ctx.pos, &lastdirent->d_off))
591 error = count - buf.count;